CYBER SECURITY STRATEGY OF MONTENEGRO 2018-2021 out of 193 countries covered by this research. Compared to the region, Montenegro ranks higher than Albania (89), Serbia (90), Bosnia and Herzegovina (136), and Slovenia (84), while Croatia (41) and Macedonia (55) rank higher than Montenegro. STRATEGIC OBJECTIVE: The Government of Montenegro will continue its dedicated work on the further strengthening of the cyber security capacities in the sense of providing adequate human and financial resources as well as meeting other needs necessary for efficient and agile cyber capacities of Montenegrin institutions aimed at ensuring safe cyber space, providing business incentives and ultimately contributing to the economic prosperity of Montenegro. PLAN OF ACTION AND INDICATORS: a) Relevant institutions in the field of cyber security will establish CIRTs or identify staff members whose basic tasks will be related to the activities from the cyber security domain - so-called local CIRTs. Indicator of success: the percentage-wise increase of the current number of CIRTs compared to the number of established teams and the number of institutions that should have CIRTs. b) Relevant institutions must have capacities to recognise, identify and conduct annual risk analysis, or if necessary, risk analysis for a shorter period of time, which will be related to information systems within their own institutions or within their scope of work. Indicator of success: the number of conducted risk analyses compared to the number of institutions. 11 c) Budgetary funds must be allocated every year to separate bodies or organisational units within institutions that have been identified as key for Montenegrin cyber security system so that they can procure adequate resources and tools for the effective functioning. Indicator of success: the number of institutions which have budgetary funds intended for cyber security and the number of institutions that have a trend of increasing the annual budget for these needs. d) Relevant bodies must define an optimal number of staff members in their CIRT, i.e. the number of employees who will be in charge of cyber security, with the aim of providing an adequate response to threats, challenges, risk analysis and possible attacks to their information systems. The previously said must be done at the annual level in order to obtain the current number of employees and also the necessary number of employees at the national level. ENISA11 recommends that CIRT should have a minimum of 12 staff members for a fully staffed 24/7 shift. Indicator of success: a report on the minimal number of staff members in charge of cyber security. 2. Centralisation of cyber expertise and resources STRATEGIC OBJECTIVE: The Government of Montenegro will undertake activities with a view to centralising and gathering expertise in the field of cyber security in order to: strengthen capacities for the purpose of responding efficiently to sophisticated cyber threats against critical information structures and other important information systems; understand risks to cyberspace of Montenegro; More information via link: https://www.enisa.europa.eu/publications/csirt-setting-up-guide 25